Rate limiting

Suave includes Suave.RateLimit to protect endpoints. Strategies: fixed window, sliding window, and token bucket. Limited clients receive HTTP 429 with rate-limit headers.

Quick start

open Suave
open Suave.RateLimit
open Suave.Successful

let app =
  rateLimit (perMinute 10) (OK "Hello")

startWebServer defaultConfig app

Strategies

// Fixed window (simple)
perMinute 100 |> withStrategy FixedWindow

// Sliding window (smoother)
perMinute 100 |> withStrategy SlidingWindow

// Token bucket (bursts)
{ perSecond 10 with
    strategy = TokenBucket 2.0  // refill rate
    maxRequests = 20 }          // burst capacity

Key extractors

By default limits apply per client IP. You can key by user, header, or custom logic:

perMinute 100 |> withKeyExtractor userKeyExtractor
perMinute 100 |> withKeyExtractor (headerKeyExtractor "X-API-Key")

Messages and Retry-After

perMinute 10
|> withMessage "Slow down."
|> withRetryAfter 60

See also the rate limiting recipe, example project, and API reference.